EU privacy advocates accuse US data annotation firm of snooping on contractors

Noyb files five complaints in four member states over alleged tracking of workers on Scale AI's Outlier platform

US data annotation operation Scale AI faces five GDPR complaints in four EU countries over allegations that it unlawfully monitors European contractors.

Privacy campaigner noyb alleges that Scale tracks contractors who perform data annotation work on its Outlier AI platform. Like workers on Amazon's Mechanical Turk platform of yore, Outlier contractors label data, evaluate AI-generated responses, and perform other tasks to improve AI models. Scale counts companies including OpenAI, xAI, Anthropic, and Google, as well as the US government, among its customers.

Scale AI faces allegations similar to those noyb has made against other US tech firms since the EU’s General Data Protection Regulation (GDPR) went into effect in 2018, namely violations of said regulation.

REG AD

With all that work being done digitally and remotely, Scale has extensive data collection practices to not only verify the identity of Outlier workers, but also to extensively track their activity. 

REG AD

“Platform work seems to be fertile ground for a whole new type of workplace surveillance,” said Thomas Le Bonniec, sociology researcher at French privacy research group DIPLab, who co-authored a report earlier this month examining Outlier's data collection practices. “This would be seen as unacceptable in any other form of employment in the European Union.”

Among the issues that raised the hackles of noyb's lawyers was identity verification conducted by Persona, a company that has faced scrutiny over an exposed test environment associated with its efforts to secure US government business. Researchers speculated that the system could be used to build a people tracker, but Persona rejected that interpretation and denied having active US government contracts. Separately, Persona's relationship with chat app Discord soured ahead of the platform's broader age verification rollout, with Discord saying the provider failed to meet its requirements for on-device facial age estimation.

According to noyb, Persona collects biometric data to verify Outlier contractors are who they say they are, as well as gathering IP addresses, device info, geolocation data, addresses, and credit data of Outlier users. 

In addition to the biometric identification data, noyb accuses Scale of tracking Outlier workers by collecting system data and device activity (including activity outside of Outlier work), and transmitting that to third parties including LinkedIn, TikTok, Facebook, and other analytics services as often as every few seconds. Noyb warns that the information could be used to profile individuals and serve targeted advertising.

“Such constant and extensive tracking while working really goes against all reasonable expectations,” noyb data protection lawyer Lisa Steinfeld Leiser said of the allegations. “Why should LinkedIn or Facebook know which tasks you're working on?”

Noyb has filed complaints in France, Italy, the Netherlands, and Austria against Scale, arguing that it lacks a legal basis to install tracking software on contractors’ devices. The US company also stands accused of violating GDPR rules on data minimization, which requires that companies only collect data that’s strictly necessary for specific purposes. The complaints also assert Scale violated GDPR rights to data access after ignoring complainants’ requests to access the records of what data Scale had stored on them, as well as country-specific laws in the nations where the complaints were filed. 

Noyb is asking data protection authorities in those nations to conduct a full investigation and, if necessary, fine Scale for its alleged violations. 

""The report’s claims are unfounded and inaccurate," Scale told us after this article was first published. "Outlier’s practices are disclosed to contributors and require their consent. We use standard tools to verify identities, prevent fraud, protect confidential project information, and ensure accurate payment."

REG AD

The complaint is likely to give further fuel to the digital sovereignty movement sweeping the EU, which has begun to realize in the past couple of years that it may not be in the best interest of the bloc to be entirely beholden to US tech companies, even if such a separation may be painfully difficult. ®